Beta

Create a tenant

A new tenant starts with its own users, OAuth settings, audit history and logs. You are its first Tenant Admin.

Certificate chain inspector

Read a certificate chain: who each certificate names, its key and extensions, its fingerprints, and whether each one was issued by the next.

Everything happens in this browser. What you paste is not sent or stored, and leaving the page clears it.

Chain

Paste PEM certificates (-----BEGIN CERTIFICATE-----), leaf first and each followed by its issuer, as a server sends them. One base64 DER certificate also works. Never paste a private key.

Checks whether the first certificate is valid for this host, such as www.example.test.

What the inspector checks

For each pair of certificates, the inspector checks that the names chain, that the key identifiers agree, that the issuer is a certificate authority allowed to sign certificates, and that the signature verifies with the issuer's key. It checks RSA, ECDSA P-256 and P-384, and Ed25519 signatures; others, such as SHA-1 signatures on old roots, are described but not checked. It does not check revocation or your trust store, which decide whether a verifier accepts the root.

We value your privacy

We use cookies and similar technologies to enhance your browsing experience, and analytics to understand our traffic. By clicking "Allow all", you consent to optional analytics. Cookie Policy

Tools